Executive brief
OpenEXR is the industry-standard library for reading and writing EXR image files used in motion picture production and visual effects. A flaw in the Python bindings causes uninitialized heap memory to be returned when processing specially crafted EXR files with layer-prefixed color channels, potentially exposing sensitive data from the application's memory to any code that processes the resulting image data.
Technical details
The vulnerability is a buffer initialization flaw in PyOpenEXR's setDeepSliceData() function. When processing deep scanline EXR files with layer-prefixed RGB channels (e.g., left.R, left.G, left.B), the lane-offset calculation uses strcmp() to match exact channel names "G", "B", and "A", but fails to match prefixed variants like "left.G" and "left.B". As a result, channels 1 and 2 remain uninitialized and point to stale heap data, while channel 0 receives all decoded samples and the green/blue channels contain garbage. The default channel coalescing behavior (separate_channels=False) triggers the vulnerable code path. An attacker can craft a malicious EXR file that, when read by a Python application using the default OpenEXR.File API, causes heap memory to be returned and potentially logged, serialized, or processed. Patched versions 3.3.13 and 3.4.14 fix this by checking only the final character of the channel name instead of requiring an exact match.
Affected products
- Academy Software Foundation OpenEXR 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Fixed in versions 3.3.13 and 3.4.14